Amazon Bedrock Agentcore Starter Toolkit up to 0.3.13 Agent Import server-side request forgery

Summaryinfo

A vulnerability was found in Amazon Bedrock Agentcore Starter Toolkit up to 0.3.13. It has been declared as problematic. Affected is an unknown function of the component Agent Import. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-106032. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Amazon Bedrock Agentcore Starter Toolkit up to 0.3.13 and classified as problematic. Affected by this issue is some unknown processing of the component Agent Import. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality. CVE summarizes:

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files, via crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group. To remediate this issue, users should upgrade to version 0.3.14. Note that bedrock-agentcore-starter-toolkit is deprecated. The @aws/agentcore npm CLI is the supported replacement and does not contain this issue. Migration to @aws/agentcore is the recommended long-term path.

The advisory is shared for download at pypi.org. This vulnerability is handled as CVE-2026-106032 since 10/06/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.3.14 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Amazon

Name

• Bedrock Agentcore Starter Toolkit

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7
• 0.3.8
• 0.3.9
• 0.3.10
• 0.3.11
• 0.3.12
• 0.3.13

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion